Spamhaus is a nonprofit threat intelligence organization that maintains the most widely used email blocklists on the internet. When your sending IP or domain appears on a Spamhaus list, thousands of mail servers can reject or spam-folder your mail within hours. Most listings are self-service to check and, when you qualify, to remove.
Reads public DNS only. Nothing is stored unless you save the domain to an account.
This guide explains what Spamhaus does, walks through its main lists (SBL, XBL, PBL, DBL, and CSS), shows how listings happen, and covers how to check a listing and request removal. It also explains why a PBL listing on a residential IP is normal and usually not a problem you need to fix.
What Spamhaus is
The Spamhaus Project publishes DNS-based blocklists, commonly called DNSBLs. A receiving mail server queries a Spamhaus zone in real time during the SMTP conversation. If the connecting IP address or a domain in the message body is listed, the receiver can reject the message outright, defer it, or route it to spam.
Spamhaus data is queried billions of times per day and feeds directly into the filtering decisions of large mailbox providers and countless self-hosted servers. That reach is why a Spamhaus listing carries more weight than most other blacklists. For a broader view of how blacklists fit into deliverability, see how to get off an email blacklist.
Spamhaus separates its data into several zones so that receivers can apply different policies to each. Knowing which list you are on tells you both why you were listed and how to get removed.
The main Spamhaus lists
Each Spamhaus list targets a different kind of risk. Most list IP addresses, and one lists domains.
| List | Full name | Lists | Typical reason |
|---|---|---|---|
SBL | Spamhaus Blocklist | IPs | IPs observed sending spam or under spammer control |
XBL | Exploits Blocklist | IPs | Compromised or infected hosts, botnets, open proxies |
PBL | Policy Blocklist | IPs | IP ranges that should not send mail directly (residential, dynamic) |
CSS | Combined Spam Sources | IPs | Low-reputation senders, snowshoe spam, some compromised hosts |
DBL | Domain Blocklist | Domains | Spam, phishing, or malware domains in message content |
Spamhaus also publishes a combined zone called ZEN, which merges the SBL, CSS, XBL, and PBL IP data into a single query so receivers can check everything at once. The DBL is queried separately because it lists domains, not IPs.
SBL (Spamhaus Blocklist)
The SBL contains individual IP addresses and ranges that Spamhaus recommends receivers do not accept mail from. Listings are made by Spamhaus researchers when an IP is seen sending spam or appears to be under the control of spammers or cybercriminals. SBL listings are evidence-based and generally require the network owner or ISP to resolve the underlying problem before removal.
XBL (Exploits Blocklist)
The XBL lists IP addresses of hosts that have been compromised, including malware-infected machines, botnet nodes, open proxies, and open relays. A clean server can land on the XBL if it is hacked and used to relay spam, or if it shares an IP with a compromised device. The XBL is largely automated and offers a self-service removal path once the exploit is cleaned up.
PBL (Policy Blocklist)
The PBL is different from the others. It does not mean you sent spam. The PBL lists IP ranges that should not send mail directly to the internet, which almost always means dynamic and residential broadband addresses assigned by ISPs. ISPs submit their own ranges, and Spamhaus adds ranges based on policy. More on why this is normal below.
CSS (Combined Spam Sources)
The CSS is an automatically generated dataset that catches low-reputation IPs not already covered by the PBL or XBL. It frequently targets snowshoe spam, where a sender spreads volume thinly across many IPs to dodge volume-based filters, and it can also pick up compromised hosts. CSS listings are part of the SBL data and use the same self-service removal form.
DBL (Domain Blocklist)
The DBL is the only Spamhaus list that targets domains rather than IPs. It lists domains found in the body of spam, phishing, or malware messages. Even a well-configured sending IP will see delivery problems if the domain in your links or your From address is on the DBL. Because it works on domain reputation, a clean IP alone is never enough to stay off it.
How listings happen
Spamhaus uses a mix of spam traps, automated heuristics, live spam feeds, and manual research. Common triggers include:
- Sending to spam trap addresses, which strongly signals a poorly maintained or purchased list. See what a spam trap is.
- A sudden volume spike from a cold IP with no warmup history.
- A compromised server, CMS, or account relaying spam without your knowledge.
- High complaint rates or hard bounces that indicate low list hygiene.
- Domains that appear in the content of abusive messages, which drives DBL listings.
Many listings are a symptom of a deeper deliverability problem rather than the root cause. Weak authentication, a poor sender reputation, or missing alignment can all contribute to the sending behavior that gets you listed.
Why PBL listings are normal for residential IPs
If you check your home or office broadband IP against Spamhaus and find it on the PBL, that is expected and correct. ISPs assign dynamic and residential addresses that were never intended to run a mail server. Spamhaus, and the ISPs themselves, list these ranges so that receivers reject direct-to-MX mail from them, because legitimate mail from those addresses should go out through the ISP or provider smarthost.
A PBL listing only becomes a problem if you are actually running an outbound mail server on a static IP inside a listed range. In that case, Spamhaus offers a self-service exclusion:
- The IP must be static, not dynamic. Dynamic addresses are not eligible.
- Look up the IP in the Spamhaus IP and Domain Reputation Checker and open the details for the PBL listing.
- Follow the removal steps and confirm from a non-free email address. Requests from Gmail, Yahoo, Outlook, or other free mailbox domains are automatically invalidated by the security checks.
- Allow roughly 15 minutes for DNS propagation.
End-user single-IP PBL exclusions expire after one year and are reversed immediately if spam is detected from the IP. For most senders using a reputable provider, the cleaner fix is not to send directly from a residential IP at all. Use your provider's outbound servers, and make sure your setup has a valid forward-confirmed PTR record so receivers can verify the sending host.
How to check a Spamhaus listing
Spamhaus retired its standalone Blocklist Removal Center and now consolidates lookups in the IP and Domain Reputation Checker on spamhaus.org. Enter your sending IP or domain, and it reports which zones list you, with details and next steps for each.
Before you check Spamhaus, confirm which IP and domain you actually send from. Read your email headers from a delivered message to find the connecting IP, then check that address rather than your website or office IP. For a wider sweep across multiple blocklists at once, see how to check if a domain is blacklisted.
How to request removal
The right removal path depends on the list:
- PBL: Self-service exclusion for eligible static IPs, as described above.
- XBL and CSS: Use the self-service removal form in the Reputation Checker after you have cleaned up the underlying exploit or spam source. One request can cover both when both apply. Removal often completes within minutes of approval.
- SBL: Usually requires the network owner or ISP to act. As an end user, contact your ISP, hosting provider, or email service provider, who must resolve the issue and request removal on the relevant SBL record.
- DBL: Use the removal path shown for the listed domain in the Reputation Checker, after you have stopped the abusive activity tied to that domain.
Removal will not stick if the behavior that caused it continues. Fix the root cause first: tighten list hygiene, secure any compromised accounts or servers, and get your authentication in order. Publish correct SPF, DKIM, and DMARC records, and follow general email deliverability best practices so you stay off the lists once you are removed.
Frequently asked questions
Is being on the Spamhaus PBL bad?
Not by itself. The PBL lists residential and dynamic IP ranges that should not send mail directly to the internet, so a home or office broadband IP being listed is normal and expected. It only matters if you are running an outbound mail server on a static IP in that range, in which case you can request a self-service exclusion.
How long does Spamhaus removal take?
For self-service lists like the PBL, XBL, and CSS, removal typically propagates within about 15 minutes to an hour once approved. SBL removals depend on your ISP or network owner acting first, so they can take longer. Removal only holds if you have stopped the activity that triggered the listing.
Why do I keep getting relisted on Spamhaus?
Relisting almost always means the root cause is still active. Common culprits are a compromised server or email account, purchased or stale lists that hit spam traps, or high complaint and bounce rates. Fix the underlying problem, clean your list, and secure your systems before requesting removal again.
Does the Spamhaus DBL list my sending domain or the links inside my email?
The DBL can list either. It targets any domain with a poor reputation that appears in a message, including the domain in your From address, your links, or the domains those links redirect to. If a shared link-tracking or URL-shortener domain is listed, your mail can be filtered even when your own domain is clean.
Spamhaus reacts to how your mail actually behaves, and that behavior starts with correct authentication and alignment. Run a free scan of your domain with SPFWise to confirm your SPF, DKIM, and DMARC are set up right, so you stay off the blocklists and keep your mail in the inbox.